turns out request.args has some special behaviour that forces a 400 instead of throwing a KeyError when trying to read an arg that wasn't supplied :/ havent seen anything about it in flask's docs
codl